DEV Community

Honey Kiran
Honey Kiran

Posted on Originally published at honeykiran.substack.com on

OpsBites: A Disabled GitHub Action Came Back With the Malware Still Inside

#security #github #devops #cicd

A paper version tag on a string being pulled by a shadowy hand, beside a steel padlock chained to a solid block engraved with a long hexadecimal code — mutable tags can be moved, commit SHAs cannot.

A dead action came back to life — and it was still loaded.

In May 2026, two handy GitHub Actions from actions-cool — issues-helper and maintain-one-comment — were compromised in the Mini Shai-Hulud campaign. They quietly harvested CI credentials, the keys to your build house. GitHub did the right thing and disabled both repos. Story over, right? Not quite. On September 16, both repos became downloadable again. Nobody cleaned them first. Their release tags still pointed straight at the malicious code from May 18. So any workflow that referenced them by version tag politely downloaded and ran the payload on its very next run. GitHub disabled them again on September 25, but the window was open for nine days. GitHub’s dependency graph lists about 15,000 repositories depending on issues-helper alone.

Here is the simple heart of it. A version tag like @v3 is a sticky note. Whoever controls the repo can peel it off one commit and stick it on another — including a malicious one. A full-length commit SHA is the commit itself, written in stone. It cannot be moved, re-pointed, or quietly swapped while you are making tea. Workflows pinned to a full SHA of a clean version were never exposed in this incident. Not lucky. Just pinned.

The copy-paste bit:

# Risky — the tag can move under you
- uses: actions/checkout@v4

# Pinned — this exact commit, every run
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
Enter fullscreen mode Exit fullscreen mode

Fair question: won’t pinned versions rot while the world moves on? That is exactly what Dependabot is for. It understands SHA-pinned actions perfectly well, and when a new version lands it opens a pull request that updates the SHA and the version comment together. You review the diff like any other change, merge, done. You get updates and a lock — no need to choose.

One gotcha before you run off pinning everything: a SHA is only as clean as the version you pin. Pin a compromised commit and you have just guaranteed the bad code runs forever, very reliably. So pin clean, known-good versions — and here is the serious bit: if your workflows used either actions-cool action by tag, security researchers advise rotating your CI secrets now. Assume they travelled.

Tags are promises. SHAs are proof. Pin the proof.

Try it first in a staging or throwaway repo — pin one workflow, watch Dependabot’s first update PR land, then roll it out.

© 2026 Honey Kiran. All rights reserved.

Honey Kiran · DevOps & Platform Engineering

DevOps, platform engineering, and AI-assisted operations — explained the practical way.

Got a one-liner that saved your pipeline? Drop it in the comments — the best ones get featured.

Examples are illustrative — validate in your own environment before running in production.

Disclaimer

  • This post describes my personal experience with my own systems and accounts, in my own words. It is a first-person account of what I observed and what I do in my own work — not a statement of any company's intentions, policies, or internal decisions. Where I do not know something, the post says so.

  • I am not affiliated with, endorsed by, or speaking for any company, product, or vendor named in this post. All product and company names are trademarks of their respective owners and are mentioned only to describe the experience accurately.

  • Any error messages, documentation excerpts, or figures quoted here are reproduced from my own records or from the public sources linked in the post, believed accurate at the time of writing. Product behavior changes over time; verify against current official documentation before relying on any detail.

  • Nothing in this post is professional, financial, legal, or security advice for your specific situation. Examples are illustrative — validate in your own environment before running anything in production.

  • Corrections are welcome. If any company named here publishes an official statement, or if any detail is wrong, I will update this post and note the correction. The goal is an accurate public record, not a verdict.

Top comments (0)